Researchers Successfully Booted Jailbroken Version of iOS 27 on an iPhone 11 Pro

Security researchers have successfully booted a jailbroken build of iOS 27 on an iPhone 11 Pro by combining the recently disclosed usbliter8 SecureROM exploit with a heavily modified custom firmware workflow.

The demonstration targets Apple’s A13-powered iPhone 11 Pro. It shows how physical access to a device in DFU mode can be used to bypass normal boot-chain restrictions.

The project, published in the 34306/usbliter8-fun GitHub repository, is based on earlier work by developer wh1te4ever and adds build-specific patches for iOS 27.0 beta 2, identified as build 24A5370h.

Apple’s iOS 27 beta 2 release used that build number, while the iPhone 11 Pro remains listed as an iOS 27-compatible device. At the center of the research is usbliter8, a bootrom-level exploit released by Paradigm Shift for Apple A12 and A13 processors.

The exploit operates through USB Device Firmware Upgrade mode. It requires an attacker or researcher to connect specialized hardware to the target device physically.

Because SecureROM is immutable code embedded in silicon, a vulnerability at this layer cannot be completely removed through a normal iOS software update.

Jailbroken iOS 27 Runs on iPhone 11 Pro

The iPhone 11 Pro implementation reportedly uses an RP2350-based Raspberry Pi Pico 2 configured as a USB exploit device. Once the phone enters a compromised DFU state, identified by the PWND:[usbliter8] USB serial marker, researchers can load modified boot components and restore a custom iOS image.

The attack is not remote and requires DFU access, a USB connection, compatible hardware, and detailed technical preparation. The custom firmware includes kernel and userland changes designed to weaken several iOS security controls.

Reported modifications include bypasses for USB Restricted Mode, sandbox execution restrictions affecting /var/jb, and Apple Mobile File Integrity trust-cache checks. These changes allow unsigned or otherwise untrusted code to execute, which is a core requirement for a jailbreak environment.

Researchers also modified system services to handle the instability caused by using incompatible or unavailable Secure Enclave Processor components.

Patches were added to avoid crashes in services such as coreauthd and ctkd. At the same time, activation-related changes attempt to make the modified device appear activated.

The repository additionally turns off a Screen Time-related launchd job after researchers encountered a Setup Assistant deadlock. The resulting installation is highly experimental and comes with major limitations.

According to the project documentation, restoring the custom firmware can erase the device and leave important services broken, including SEP functions, passcode support, Wi-Fi, baseband connectivity, Bluetooth functions, and Apple services. The repository explicitly warns users not to attempt the procedure on a primary phone.

After the device is booted, the project supports USB-based SSH access. It describes installing a bootstrap environment and the Sileo package manager. However, network connectivity may require USB internet sharing from a Mac because normal Wi-Fi and cellular functions can be unavailable on the modified device.

The research demonstrates the lasting security implications of SecureROM-level vulnerabilities on older Apple hardware. Although exploitation requires physical access and technical skill, usbliter8 enables researchers to study devices outside Apple’s standard chain of trust, including on newer iOS versions such as iOS 27.

No CVE, CVSS score, Apple security advisory, or publicly reported in-the-wild exploitation had been disclosed when usbliter8 was initially reported.

 Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now.